Overview

overview

10

Static

static

3

1a7257d99c...18.exe

windows7-x64

7

1a7257d99c...18.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1a7257d99c2c0abb969bb9415659ad0c_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240628-rmlbraxall

  • MD5

    1a7257d99c2c0abb969bb9415659ad0c

  • SHA1

    de3e1bad4ffc6078baa689f928aa77d8f813b1a6

  • SHA256

    2f14749bbc71b10119d94ff07afd6babe8eb27abaad7b9266c08f98efcbf9de4

  • SHA512

    d6b9d73298430e6dfc5ec6db29e6c165484abd194392dddbe0e8007434723619a07791bb17399792d162cf40d0fa99156ad80c8850a2d086235dbfb44488a51f

  • SSDEEP

    24576:FNLR/4KyTpixLNPHqtURjZnli5kaKuOB9hiDeORvC5XKMz:rLR/4Ky6L1qtURjZlakPiDeO14X9

Score
10/10
ardamaxkeyloggerstealer

Malware Config

Targets

    • Target

      1a7257d99c2c0abb969bb9415659ad0c_JaffaCakes118

    • Size

      1.1MB

    • MD5

      1a7257d99c2c0abb969bb9415659ad0c

    • SHA1

      de3e1bad4ffc6078baa689f928aa77d8f813b1a6

    • SHA256

      2f14749bbc71b10119d94ff07afd6babe8eb27abaad7b9266c08f98efcbf9de4

    • SHA512

      d6b9d73298430e6dfc5ec6db29e6c165484abd194392dddbe0e8007434723619a07791bb17399792d162cf40d0fa99156ad80c8850a2d086235dbfb44488a51f

    • SSDEEP

      24576:FNLR/4KyTpixLNPHqtURjZnli5kaKuOB9hiDeORvC5XKMz:rLR/4Ky6L1qtURjZlakPiDeO14X9

    Score
    10/10
    ardamaxkeyloggerstealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks